FrankChen021 commented on PR #20038: URL: https://github.com/apache/druid/pull/20038#issuecomment-5322945004
Codex triage disposition: CLOSED_HIGH_EFFORT/WONT_FIX_LARGE_CHANGE Verified immediately before this comment: - PR #20038 is open, mergeable but unstable. - head: e4d1d1a5876b24edf2ec199e95211dcc3081cfa5 - base master: cb26014728ab3239bc8d7391f9cf6466e63905b0 - The merge-base diff is exactly one file: [extensions-contrib/druid-iceberg-extensions/pom.xml](https://github.com/apache/druid/blob/e4d1d1a5876b24edf2ec199e95211dcc3081cfa5/extensions-contrib/druid-iceberg-extensions/pom.xml), changing only hive.version 3.1.3 -> 4.2.0 in commit [e4d1d1a](https://github.com/apache/druid/commit/e4d1d1a5876b24edf2ec199e95211dcc3081cfa5). Why this cannot be fixed as a dependency-only one-line follow-up: - The effective Hive 4.2.0 graph adds Tez 0.10.5/Hadoop 3.4.1, Hive standalone-metastore gRPC 1.72.0, and javax.xml.bind:jaxb-api 2.2.11. The Druid module selects Hadoop 3.5.0, direct Google Cloud Storage selects gRPC 1.59.0, and it intentionally pins hive-storage-api 2.8.1 for the existing Hive 3 compatibility workaround. - The five static failures are deterministic dependency-graph failures, not infrastructure: [packaging-check](https://github.com/apache/druid/actions/runs/32082545562/job/95548191991), [static-checks-maven](https://github.com/apache/druid/actions/runs/32082545562/job/95548192019), [strict-compilation](https://github.com/apache/druid/actions/runs/32082545562/job/95548192168), [openrewrite](https://github.com/apache/druid/actions/runs/32082545562/job/95548192232), and [validate-dist](https://github.com/apache/druid/actions/runs/32082545770/job/95548192589) all fail on the same banned JAXB and RequireUpperBoundDeps conflicts. - Four unit shards independently fail at runtime: [D/H/L](https://github.com/apache/druid/actions/runs/32082545770/job/95548192600) reports HiveConf$ConfVars.METASTOREURIS NoSuchFieldError plus Hadoop ABI errors; [T/F/G/J](https://github.com/apache/druid/actions/runs/32082545770/job/95548192613), [S](https://github.com/apache/druid/actions/runs/32082545770/job/95548192620), and [I/A/U](https://github.com/apache/druid/actions/runs/32082545770/job/95548192632) report AuthenticationFilter.constructSecretProvider(...) NoSuchMethodError. The JUnit report action is only surfacing the test failures. - The two skipped checks, [coverage-jacoco](https://github.com/apache/druid/actions/runs/32082545770/job/95555802783) and [docker-tests](https://github.com/apache/druid/actions/runs/32082545770/job/95555802760), have no independent logs; docker-tests needs the failed unit-tests workflow. No failed job is in progress, and no rerun is useful. Compatibility and release evidence: - Druid's [Iceberg documentation](https://github.com/apache/druid/blob/e4d1d1a5876b24edf2ec199e95211dcc3081cfa5/docs/development/extensions-contrib/iceberg.md) and [input-source contract](https://github.com/apache/druid/blob/e4d1d1a5876b24edf2ec199e95211dcc3081cfa5/docs/ingestion/input-sources.md) expose the Hive catalog through hive-site/core-site, catalogProperties, catalogUri, warehousePath, Kerberos settings, and the type=hive JSON subtype. The source changes no Druid JSON, wire, persisted Iceberg, segment, or extension SPI shape, but the Hive catalog runtime path is broken by the new classpath ABI conflicts. - Apache Hive's [4.2.0 release notes](https://hive.apache.org/general/downloads/) require Java 21 and state that 4.2.0 works with Hadoop 3.4.1 and Tez 0.10.5. Hive's [4.2.0 branch README](https://github.com/apache/hive/tree/rel/release-4.2.0) also calls out metastore schema upgrade scripts for server upgrades. Those requirements do not match Druid's managed Hadoop 3.5.0 graph and cannot be resolved safely by suppressing individual enforcer checks. - The Hive 4.2.0 upgrade is security-positive for CVE-2025-62728, which is fixed in 4.2.0; that does not make this runtime graph compatible. Hive source/release metadata is Apache-2.0 with NOTICE material, and Druid already records Hive Storage API 4.2.0, Hadoop, JAXB runtime, and gRPC licenses. No license/NOTICE file changed in this PR; the newly pulled Hive metastore/Tez graph still needs a deliberate dependency and license review as part of a broader migration. No files were changed, no fix commit was created, and no branch push or rerun was performed. Closing because the required fix is a broad Hadoop/Hive/Tez/gRPC/JAXB compatibility migration, not a surgical correction to this PR. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
